# US 2018/0324185 A1 · Techniques for detecting unauthorized access to cloud applications based on velocity events > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324185 A1 - Document ID: US20180324185A1 - Status: Published application - Kind: A1 - Application number: 16/033,885 - Filed: 2018-07-12 - Published: 2018-11-08 - Earliest claimed: 2015-11-30 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC. - Inventors: Yonatan MOST; Yinon COSTICA - Web page: https://patentgrep.com/patent/US20180324185A1 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/16: Threshold monitoring - H04L 63/0281: {Proxies} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for detecting unauthorized access to a cloud application hosted in a cloud-computing platform are presented. The method comprising: identifying, by a managed proxy device, a first access attempt to a cloud application at a first time and from a first location; identifying, by a managed proxy device, a second access attempt to the cloud application at a second time and from a second location; computing a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; checking if the computed velocity is greater than a velocity threshold; and generating a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized. ## Claims ### Claim 1 A method for detecting unauthorized access to a cloud application hosted in a cloud-computing platform, comprising: identifying, by a managed proxy device, a first access attempt to a cloud application at a first time and from a first location; identifying, by a managed proxy device, a second access attempt to the cloud application at a second time and from a second location; computing a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; checking if the computed velocity is greater than a velocity threshold; and generating a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized. ### Claim 2 (depends on 1) The method of claim 1, wherein the velocity threshold is based on a velocity required to travel from the first location to the second location within the difference between the first time and the second time. ### Claim 3 (depends on 1) The method of claim 1, further comprising: upon determining that the required velocity is not above the velocity threshold, determining that the second access attempt is authorized. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining whether the velocity event is a false positive. ### Claim 5 (depends on 4) The method of claim 4, further comprising: upon determining that the velocity event is a false positive, determining that the second access attempt is authorized; and upon determining that the velocity event is not a false positive, determining that an access attempt is unauthorized. ### Claim 6 (depends on 5) The method of claim 5, wherein determining whether the velocity event is a false positive further comprises: computing a risk score using a decision tree, wherein the determination is based on the risk score. ### Claim 7 (depends on 6) The method of claim 6, wherein the decision tree is generated based on at least information related to legitimate access attempts by the user, wherein the decision tree is updated as legitimate access attempts by the user are detected. ### Claim 8 (depends on 1) The method of claim 1, further comprising: upon generating a velocity event, activating at least one protective measure based on at least one rule. ### Claim 9 (depends on 8) The method of claim 8, wherein each protective measure is any of: blocking access, raising a security alert, ignoring the velocity event, granting limited access, and logging out a user designated by the same username initiated the first access attempt and the second access attempt. ### Claim 10 (depends on 1) The method of claim 1, wherein the managed proxy device is connected between client devices and the cloud-computing platform hosting the first cloud application and the second cloud application. ### Claim 11 A computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for detecting unauthorized access to a cloud application hosted in a cloud-computing platform, the process comprising: identifying, by a managed proxy device, a first access attempt to a cloud application at a first time and from a first location; identifying, by a managed proxy device, a second access attempt to the cloud application at a second time and from a second location; computing a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; checking if the computed velocity is greater than a velocity threshold; and generating a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized. ### Claim 12 A system for detecting unauthorized access to a cloud application hosted in a cloud-computing platform, the system is connected between client devices accessing the cloud-computing platform hosting the first cloud application and the second cloud application, comprising: a processing unit; and a memory, the memory containing instructions that, when executed by the processing unit, configure the system to: identify a first access attempt to a cloud application at a first time and from a first location; identify a second access attempt to the cloud application at a second time and from a second location; compute a velocity between the first access attempt and the second access attempt based on the first time, the second time, the first location, and the second location; check if the computed velocity is greater than a velocity threshold; and generate a velocity event when the computed velocity is greater than the velocity threshold, wherein the velocity event indicates that an access attempt is unauthorized. ### Claim 13 (depends on 12) The system of claim 12, wherein the velocity threshold is based on a velocity required to travel from the first location to the second location within the difference between the first time and the second time. ### Claim 14 (depends on 12) The system of claim 12, wherein the system is further configured to: upon determining that the required velocity is not above the velocity threshold, determine that the second access attempt is authorized. ### Claim 15 (depends on 12) The system of claim 12, wherein the system is further configured to: determine whether the velocity event is a false positive; upon determining that the velocity event is a false positive, determine that the second access attempt is authorized; and upon determining that the velocity event is not a false positive, determine that an access attempt is unauthorized. ### Claim 16 (depends on 12) The system of claim 12, wherein the system is further configured to: compute a risk score using a decision tree, wherein the determination is based on the risk score. ### Claim 17 (depends on 16) The system of claim 16, wherein the decision tree is generated based on at least information related to legitimate access attempts by the user, wherein the decision tree is updated as legitimate access attempts by the user are detected. ### Claim 18 (depends on 12) The system of claim 12, wherein the system is further configured to: upon generating a velocity event, activate at least one protective measure based on at least one rule. ### Claim 19 (depends on 18) The system of claim 18, wherein each protective measure is any of: blocking access, raising a security alert, ignoring the velocity event, granting limited access, and logging out a user designated by the same username initiated the first access attempt and the second access attempt. ### Claim 20 (depends on 12) The system of claim 12, wherein each of the first location and the second location is identified based on at least one rule for resolving locations.